ALT-BU-2019-3616-1
Branch sisyphus update bulletin.
Closed vulnerabilities
BDU:2019-01945
Уязвимость модуля pam_systemd демона systemd, связанная с некорректным использованием переменных окружения, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемых данных
BDU:2022-00317
Уязвимость подсистемы инициализации и управления службами systemd, связанная с некорректным связыванием привилегий, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2022-00318
Уязвимость подсистемы инициализации и управления службами systemd, связанная с неправильным присваиванием привилегий, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2019-3842
In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".
- openSUSE-SU-2019:1450
- openSUSE-SU-2019:1450
- http://packetstormsecurity.com/files/152610/systemd-Seat-Verification-Active-Session-Spoofing.html
- http://packetstormsecurity.com/files/152610/systemd-Seat-Verification-Active-Session-Spoofing.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3842
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3842
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- [debian-lts-announce] 20190424 [SECURITY] [DLA 1762-1] systemd security update
- [debian-lts-announce] 20190424 [SECURITY] [DLA 1762-1] systemd security update
- FEDORA-2019-3fa5db9e19
- FEDORA-2019-3fa5db9e19
- 46743
- 46743
Modified: 2024-11-21
CVE-2019-3843
It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.
- 108116
- 108116
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3843
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3843
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- FEDORA-2019-7322053e74
- FEDORA-2019-7322053e74
- https://security.netapp.com/advisory/ntap-20190619-0002/
- https://security.netapp.com/advisory/ntap-20190619-0002/
- USN-4269-1
- USN-4269-1
Modified: 2024-11-21
CVE-2019-3844
It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.
- 108096
- 108096
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3844
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3844
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- https://security.netapp.com/advisory/ntap-20190619-0002/
- https://security.netapp.com/advisory/ntap-20190619-0002/
- USN-4269-1
- USN-4269-1
Closed bugs
Настройка времени / часового пояса
Миграция на /run и /run/lock
нужна явная зависимость от systemd
Closed bugs
(.spec) optional --enable-debug
Closed bugs
Некорректный путь к traceroute а БД
Package rpm-build-tex updated to version 0.4.3-alt1 for branch sisyphus in task 227460.
Closed bugs
FTBFS: invalid Provides tag in rpm-build-tex
Package libclalsadrv updated to version 2.0.0-alt1_19 for branch sisyphus in task 227567.
Closed bugs
FTBFS: invalid Provides tag in libclalsadrv and libclalsadrv-devel
Package perl-Net-SSLeay updated to version 1.86_09-alt2 for branch sisyphus in task 227568.
Closed bugs
hampering default on the CD: "boot from hard disk"
Package perl-Sereal-Decoder updated to version 4.007-alt2 for branch sisyphus in task 227577.
Closed bugs
perl-Sereal-Decoder-4.005-alt1.1 builds and provides its own old bundled copy of libzstd
Package 3dprinter-udev-rules updated to version 0.2.2-alt1_1 for branch sisyphus in task 227592.
Closed bugs
Зависимость на systemd излишня